Exam CISM topic 1 question 10 discussion

Ensuring security is involved in the procurement process is the most effective way to address an organization's security concerns during contract negotiations with a third party. Involving security personnel in the procurement process allows the organization to identify and address potential security risks early on, before a contract is signed. This helps ensure that security requirements are included in the contract and that the third-party vendor is aware of and committed to meeting the organization's security standards. By having security involved in the procurement process, the organization can also ensure that the third-party vendor has adequate security controls in place to protect sensitive information and critical assets. This can include reviewing the vendor's security policies, conducting security assessments, and verifying that the vendor is in compliance with relevant laws and regulations.

Answer B is completely wrong, communicating the policy to the third party does not grantee the third party will enforce the proper measures

Answer: C. Due diligence activities are: Requirements, Questionnaire, Supplier Interviews, Risk Analysis, & Contract. Security should be included as soon as possible to define Requirements.

By involving the security team in the procurement process, you can proactively address security concerns from the outset. This allows security professionals to assess the third party's security posture, ensure that security requirements are adequately addressed in the contract, and provide valuable input to the negotiation process. It helps in aligning the security needs of the organization with the contractual agreements, leading to a more secure and compliant relationship with the third party. While other options, such as reviewing the contract with the legal department (option A), communicating security policies with the third-party vendor (option B), and conducting an information security audit (option D) are important steps, involving security in the procurement process is the proactive approach that can prevent security issues before they arise.

The most effective way to address an organization's security concerns during CONTRACT NEGOTIATIONS with 3rd party is C. It will be impossible for security to do either A, B or D without first being involved in the procurement process. Agreed that they may be involved if and when required, but that wouldn't be the most effective way. A. Security and legal along with other stakeholders will review the contract, provided security is involved in the procurement process. B. Security policy can be communicated to the 3rd party only if security is involved in the procurement process. D. If warranted, security audit can be performed on 3rd party, but this isn't possible unless security is involved in the procurement process.

By ensuring security is involved in the procurement process (Option C), you proactively consider security requirements and risks from the beginning, which can help in selecting vendors that align with your security needs and potentially avoiding security issues down the road. This approach is proactive and holistic in addressing security concerns during contract negotiations.

I agree C seems to be correct.

Question is about on going negotiations - security should be involved to address the security concerns - Legal cannot do that. And just communicating those concerns to the vendor also does not address them.

Contract negotiations are ongoing, security is involved. Then it's B

By ensuring security is involved in the procurement process (Option C), you proactively consider security requirements and risks from the beginning, which can help in selecting vendors that align with your security needs and potentially avoiding security issues down the road. This approach is proactive and holistic in addressing security concerns during contract negotiations.

I choose "C" as communicating security policy does not necessarily "ensure" that the contract will address the security requirements. Option "B" says "ensure" meaning a definitive and effective outcome

I had confusion between B and D but looks less feasible we the org have that power to go for audit by so B looks more relevant

it states during contract negotiations

it has gone past the procurement process and is in contract negotions, so answer is B

Ensuring security is involved in the procurement process

C. Ensure security is involved in the procurement process.

I think D is incorrect since the contract has not been signed. The 2 sides are still negotiating and auditing efforts will be futile if the contract is not signed. Option C is also incorrect since procurement happens after contract sign off. The procurement team can sit at the negotiation table but the process of procuring materials is yet to start since there is no sign off. Option B looks appealing where the policy is shared with the vendor which is a top level administrative control. Contract negotiations more than likely happen at the exec level where it is all about policies. I vote C